CVE-2026-51732: n/a

This vulnerability arises from improper access control in the delWiFiScheduleCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which allows them to delete Wi-Fi schedule entries without authorization. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to integrity, with no confidentiality or availability impact reported. No known exploits are currently in the wild, and no vendor remediation or patch information is available at this time.

The vulnerability allows unauthorized deletion of Wi-Fi schedule entries, which could disrupt scheduled Wi-Fi configurations. There is no impact on confidentiality or availability. The integrity of Wi-Fi scheduling is compromised, potentially affecting network management policies.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Consider disabling remote management if not required.